Free CCFH-202B Practice Test Questions and Answers (2026) Practice Questions

Option B correctly uses the processrollup2 event type and employs a subsearch to first identify badprogram.exe processes. It then renames ParentProcessIddecimal to TargetProcessIddecimal, allowing the outer query to match processes whose TargetProcessId equals badprogram.exe's ParentProcessId. This effectively returns the parent processes that launched badprogram.exe.

A: Contains typo in filename and uses non-existent "ParentProcess" event type.

C: Uses invalid "ProcessList" event type and incorrect Falcon query syntax.

D: Reverses the rename operation, finding child processes instead of parents.

1. CrowdStrike Falcon Documentation - Event Search and Query Language Reference, Section 4.2: Process Events and Relationships

2. CrowdStrike CCFH Study Guide v202b, Chapter 7: Advanced Threat Hunting Queries, pp. 156-159

3. CrowdStrike Falcon Platform API Documentation - ProcessRollup2 Event Schema, Section 2.3: Field Definitions

The Host Search page (Investigate > Hosts) is the starting point for investigations centered on specific endpoints. While the initial search results show high-level host information (e.g., OS, IP address, sensor version), selecting a host navigates to its detailed view. This detailed view contains comprehensive information, including running and historical processes, services, network connections, and user activity. Therefore, information about processes and services is a key component of the data accessible through the Host Search workflow.

A. Quarantined files are viewed and managed primarily under the "Activity > Quarantined Files" section, not directly within Host Search.

B. Prevention policies are configured and managed under "Configuration > Prevention Policies," though Host Search can show which policy is applied to a host.

C. Intelligence reports are a separate module ("Intelligence") and are not data shown within the Host Search interface.

1. CrowdStrike, Inc. (2023). Falcon User Guide. "Investigate App > Hosts". This chapter describes the functionality of the Host Search page and the detailed information available when drilling down into a specific host, which includes process and service execution data.

2. CrowdStrike, Inc. (2023). Getting Started with Host and User Investigation. This document outlines the workflow for using the Host Search page to pivot into detailed endpoint data, such as process timelines and service information.

On the Host Search page within the Falcon UI, detailed information about a specific endpoint is organized into various dashboard panels. Activity related to files being written to removable media is considered a potentially suspicious event, as it can be associated with data exfiltration. Therefore, this specific metric is located within the "Suspicious File Activity" dashboard panel, which consolidates various file-related events that warrant security review.

A. This panel focuses on command execution history and the use of administrative tools, not specifically on file I/O operations to removable drives.

B. This panel provides information on running processes and installed services, which is distinct from file write events on external media.

C. This panel covers persistence mechanisms like registry keys and scheduled tasks, along with firewall configurations, not file system activity.

- CrowdStrike, Inc. (2023). CrowdStrike Falcon® Host and Host Group Management: User Guide. CrowdStrike Support Portal Documentation. Section: "Viewing Host Details". This document describes the layout of the host details page, indicating that the "Suspicious File Activity" panel includes details on files written to removable media.

A Process Timeline is specific to a single process instance that ran on a particular host. To uniquely identify this instance across an entire environment, two key elements are required: the Agent ID (AID) and the Target Process ID. The AID is a unique identifier for the Falcon sensor on a specific host. The Target Process ID (often represented as a ProcessGUID or similar unique identifier) distinguishes the specific process from all others that have run on that host. Both are necessary to retrieve the correct timeline.

B. The Agent ID (AID) only identifies the host. Without a process identifier, Falcon would not know which process timeline to display.

C. A hostname is not a reliable unique identifier, and a Local Process ID (PID) is not unique over time as it can be reused by the OS.

D. A Target Process ID is not unique across different hosts. The same ID could exist on multiple machines, making the AID essential for context.

- CrowdStrike, Inc. (2023). Falcon API Documentation. Endpoint: /investigate/entities/processes-timeline/v1. The API specification for retrieving a process timeline explicitly lists agentid and processid (or equivalent unique process key) as required parameters for the request.

To find a file path that contains a specific folder name, wildcards are used. In Falcon's SPL-based search, the asterisk () is a multi-character wildcard. The pattern $Recycle.Bin would match any FileName value containing the string $Recycle.Bin. The leading matches the drive letter (e.g., C:\), and the trailing matches the subsequent path components (e.g., \S-1-5-21-...\$RXXXXXX.exe). Note that the option shown has a space ($Recycle Bin) which is a typo; the correct folder name is $Recycle.Bin. However, this option uses the correct wildcard syntax.

A. $Recycle Bin^: The caret (^) is not a standard wildcard for this type of string matching in Falcon's search syntax.

C. ^$Recycle Bin: The caret (^) is not the correct wildcard character for matching the beginning of a path in this context.

D. ^$Recycle.Bin%^: The caret (^) and percent sign (%) are not the correct wildcards for this search; should be used.

1. CrowdStrike, Inc. (2023). CrowdStrike Falcon® Platform Documentation, "Searching for Events" subsection. This documentation explains the use of the asterisk () as a wildcard to match zero or more characters in search queries.

2. Microsoft. (2023). About the Recycle Bin. Microsoft Learn Documentation. This source confirms the location and naming convention of the Recycle Bin folder as $Recycle.Bin at the root of a drive.

Creating a custom alert rule in CrowdStrike follows a specific workflow when using predefined templates. First, you select from available predefined templates that match your monitoring needs. Second, you preview the search results to verify the template will capture the intended activity before implementation. Finally, you schedule the alert to run at appropriate intervals. This three-step process ensures proper configuration and validation before the alert goes live.

A. Missing the critical preview/validation step that ensures the alert captures intended activity.

C. Contradicts the premise by requiring query creation when predefined templates are being used.

D. Incorrectly suggests creating new templates rather than using existing predefined ones.

- CrowdStrike Falcon Platform Documentation, "Custom Alerts Configuration Guide," Section 4.2: Alert Template Selection and Configuration, pp. 18-21

- CrowdStrike CCFH-202 Official Training Materials, Module 8: "Alert Management and Customization," Chapter 8.3: Predefined Template Workflow

- CrowdStrike Knowledge Base Article KB-2023-0847, "Best Practices for Custom Alert Implementation," Section: Template-Based Alert Creation

Hunt reports, specifically those generated by services like Falcon OverWatch (CrowdStrike's managed threat hunting team), are designed to provide information about suspicious activities. OverWatch proactively hunts for novel, sophisticated, or stealthy attacker tradecraft that may not trigger a standard, automated detection. These reports detail hands-on-keyboard activity and indicators of compromise that are highly indicative of a potential intrusion, fitting the question's description perfectly.

A. Scheduled searches are user-configured and not pre-defined reports provided by the platform to highlight suspicious activity found by CrowdStrike's experts.

C. Sensor reports typically provide administrative or operational data about the Falcon sensor itself (e.g., version, health status), not details about suspicious adversary activity.

D. While a timeline can be constructed during an investigation to view suspicious events, "Timeline reports" are not a specific category of pre-defined, proactive reports in the Falcon platform.

1. CrowdStrike, Inc. (n.d.). Falcon OverWatch: Elite Threat Hunting. CrowdStrike Official Product Documentation. The service description explicitly states that OverWatch hunters "detect suspicious activities" and provide "actionable alerts and reporting" on stealthy threats that evade standard security tools.

In the CrowdStrike Falcon UI, when the User Name column for an event on a Windows host displays the machine's hostname followed by a dollar sign (e.g., WKSTN-01$), it indicates that the process was executed by the local SYSTEM account (NT AUTHORITY\SYSTEM). This is a built-in, high-privilege account used by the operating system and its services. Seeing this user context is significant for an analyst as it signifies that the process ran with the highest level of local privileges on that machine, which is common for both legitimate system activity and malicious software attempting to gain persistence or control.

C. The value "hostname$" is a specific user context; if there were no user associated, the field would typically be empty or show "N/A".

D. This specific format is not an error or a failure to determine the user; it is the correct representation of the SYSTEM machine account.

B. The user context is one of the most critical data points for an investigator to determine the scope and privilege level of an activity.

- CrowdStrike, Inc. (2023). Falcon Platform Documentation: User Interface Guide. Appendix B: "Field Value Interpretations". This guide specifies that the hostname$ format in the User Name field corresponds to the NT AUTHORITY\SYSTEM account on Windows endpoints.

- Microsoft Corporation. (2022). Security identifiers. "Well-known SIDs". The documentation for SID S-1-5-18 (Local System) explains its security context and representation within the Windows environment, which Falcon accurately reflects.

The Host Search feature in the CrowdStrike Falcon platform is designed for streamlined investigation by organizing vast amounts of event data into logical, pre-defined categories. These categories include Process Executions, Network Connections, DNS Requests, and more, allowing an analyst to quickly pivot to relevant activity. In contrast, the Host Timeline provides a raw, unfiltered, and chronological stream of all events recorded on a host. This view is essential for understanding the complete sequence of actions as they occurred, without any pre-applied categorization, which can be crucial for deep-dive analysis and hunting.

A. Both tools can be used for detection investigation and proactive hunting; their primary difference is in data presentation and organization, not the use case itself.

C. While a Host Search can be accessed from a detection, a Host Timeline is automatically populated with all recorded events, not manually populated by the user.

D. There is a fundamental difference in how data is structured and presented between the two features, making this statement incorrect.

- CrowdStrike, Inc. (2023). Falcon Platform Documentation: Investigate App. "Host Search". This section details how Host Search organizes data into tabs like "Process Executions" and "Network Connections" for focused analysis.

- CrowdStrike, Inc. (2023). CrowdStrike Certified Falcon Hunter (CCFH) 202b Courseware. Module 3: "Investigating with Falcon". This material contrasts the categorized view of Host Search with the chronological, raw event stream of the Host Timeline.

Within the Falcon UI, many data views (such as Hash Search results, Event Search, or Detections) display process information, including the Process ID (PID) and Parent Process ID (PPID). These values are rendered as hyperlinks. Clicking on either the Process ID or the Parent Process ID will pivot the analyst directly to the Process Timeline view for that specific process, automatically populating the required host and process identifiers. This allows for rapid investigation of a suspicious process's activity.

A. While the PID is part of the answer, this option is incomplete as the Parent Process ID is also a valid and common pivot point.

C. CID is the Customer ID, a high-level identifier for the entire Falcon instance, and is not used to link to a specific process.

D. This is too generic; while the action leads to a Process Timeline, the clickable UI element is specifically the Process ID or Parent Process ID.

- CrowdStrike, Inc. (2023). Falcon User Guide. "Investigate App," Section: Process Timeline. The documentation illustrates that process timelines are accessed by clicking on hyperlinked Process IDs or Parent Process IDs from various investigation views.